Reported

July 15, 2021

Issued

September 9, 2021 (last modified: September 10, 2021)

Package

bat (crates.io)

Type

Vulnerability

Categories

• code-execution

Aliases

• CVE-2021-36753
• GHSA-p24j-h477-76q3

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-36753

CVSS Score

7.8 HIGH

CVSS Details

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Patched

• >=0.18.2

Affected OSes

• windows

Description

bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.

Advisory available under CC0-1.0 license.